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Secured Virtual Private Network with Mobile Nodes 



Embodiments of the present invention relate to a virtual private network 
capable of having a plm-aUty of mobile nodes, to the components of the 
network and to the methods and processes used within the network. 

A Virtual Private Network (VPN) provides a network-like connection via a 
public network, such as the internet. Remote components of the VPN appear to 
a user as if they are physically connected via dedicated communication cables, 
when in fact the pubhc network may form at least part of the connection 
between them. 

As the VPN may use a pubhc network, security measures must be taken 
to prevent unauthorised users hacking into the VPN. The Internet Engineering 
Task Force (IETF) has developed the Internet Protocol Security (IPsec) standard, 
which is suitable for securing the VPN. The IPsec standard specifies an 
extension to TCP/IP that utiOizes data encryption and digital encryption 
technology to positively identify a user or network component. Implementation 
. of IPsec, or an equivalent security protocol, on a VPN results in a Secure Virtual 
Private Network (SVPN). 

A SVPN has a Security Gateway placed at the interface between a private 
secured network and the pubUc unsecured network. The private secured 
network forms an internal portion of the VPN, whereas those parts of the VPN 
which are part of the pubhc network are external portions of the VPN. 

The SVPN is a packet switching network in which data is sent as packets. 
Each packet has a data payload and a header. The header includes the address 
of the origin of the data and the address of the destination of the data. The 
addresses used may be pubhc IP addresses or private IP addresses. A public 
address is a globally unique address, whereas a private address is unique in the 
VPN but not necessarily globally. 
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A Security Association (SA) is a context defining a virtual simplex 
connection between two end points that affords security services to the traffic 
carried between those end points. To secure bi-directional communication 
between two nodes, two Security Associations (one in each direction) are 
required in both nodes. Among other things each context indicates an 
authentication and/or encryption algorithm and a secret (a shared key, or 
appropriate public/private key pair). 

Each node has a Security Pohcy Database (SPD) and a Security 
Association Database (SAD). The SPD specifies the treatment of every inbound 
and outboxmd packet. It also indicates which SA or SA bundle In SAD should be 
used, if any. The SPD maps traffic to a SAD entry, which has the SA parameters 
for the traffic- The Encapsulating Security Payload (ESP) [RFC2406] is one type 
of Security Association and it provides confidentiality, data origin 
authentication, connectionless integrity, anti-replay service and limited traffic 
flow confidentiality. 

MobilelPv6 (MIPv6) allows a mobile node (MN) to move from one Unk to 
another without changing the mobile node's IP address (Home Address). Thus a 
mobile node is always addressable by its Home Address (HoA). 

The HoA is an IP address assigned, for an extended period of time, to the 
mobile node witiiin its home network. It is a "static" identifier and therefore 
remains unchanged regardless of which link a mobile node uses to link to the 
network. 

The home network has a network prefix matching that of a mobUe node's 
HoA and packets destined for a mobile node's HoA will be delivered to the 
mobile node's Home Network. The mobile node may also be attached to other 
networks other than the home network, these are called Visited Networks. 

The MN is able to maintain its static identifier (HoA) and communicate in 
Visited Networks by associating a dynamic identifier (Care-of-Address) with the 
static identifier (HoA) while moving outside its home network. The Care-of- 
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Address (CoA) reflects the MN current point of attachment. The association of 
the HoA and CoA is stored in a Home Agent (HA) and correspondent nodes (CN) 
and is referred to as a "binding" or "mobility binding" when combined with the 
lifetime of the association. 

The HA is a router in the home network which tunnels packets for 
dehvery to the mobile node when it is away from the home network, and 
maintains current location information for the mobile node. The HA intercepts 
a packet sent to the HoA of the MN, encapsulates the intercepted packet usmg 
Type 2 Routing Header and sends it to the CoA of the MN. When the MN 
receives the packet in its CoA, it removes the Routing Header where the HoA 
was and forwards the packet internally to the HoA. 

The mobile node generally uses its HoA as the end point of all its 
commimlcations, and the CoA as the soxu-ce address of all IP packets that it 
sends. These packets are dehvered to their destination via normal IP routing 
mechanisms. Packets sent to the mobile node do not necessarily pass through 
the HA if th^ CoA is known to the correspondent node. 

When the MN moves to a Visited Network, the MN detects this and 
obtains a CoA on the Visited network. It then sends a Binding Update to the HA 
and any correspondent node. A correspondent node is a mobile or stationary 
peer with which a mobile node Is communicating. The Binding Update registers 
the new CoA of the MN. 

MIPv6 provides for route optimisation via return routabUity and binding 
updates. The CoA is sent to the HA and to the CN, therefore CN messages can 
be routed directly to the CoA and need not go via the HA. 

IPsec is mandatory for IPv6. In a combination of MIPv6 and IPsec, MIPv6 
confirms the vahdity of the end points, and IPsec can be used for protecting the 
actual traffic between those end points. From the IPsec point of view, the SAs 
simply take place between two static addresses, the HoA of the MN and the 
regular address of the CN. 
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In a SVPN witJi mobile nodes, each MN has or creates two pairs of SAs, 
one with the SG and the other with its HA. The SVPN can be considered to have 
an internal portion which is connected to the pubhc network via a Security 
5 Gateway (SG) and a external portion connected to and forming part of the 
public network. 

If internal addressing is used, communication between a MN, which is in 
the external portion of the SVPN and any other node of the SVPN occurs via the 

10 SAs between the MN and the SG. Thus if one MN, e.g. MNl, which is In the 
external portion of the SVPN, is communicating with another MN, e.g- MN2, 
which is also in the external portion of tihe SVPN, then all communications 
between MNl and MN2 will be via the SG using the SA pairs between MNl and 
the SG and MN2 and the SG- There should not be direct communication between 

15 MNl and MN2 via the public network because the internal addresses are 
ambiguous (not globally unique) and therefore traffic using them is not 
properly routable in the public network and also because security could be 
compromised. This results in inefficient routing. 

20 If external addressing is used, communication between one MN, e.g. MNl, 

which is in the external portion of the SVPN, and another MN, e.g. MN2, which 
is also in the external portion of the SVPN, can be directly between MNl and 
MN2 after they exchange return routability and binding messages. This 
provides for efficient but insecure communication unless a pair of up-to-date 

25 SAs between MNl and MN2 already exists in both nodes. 

It would be desirable to improve secure virtual private networks having 
mobile nodes by providing efficient and secure routing for communications 
between mobile nodes of the network. 

30 

According to first aspect of the present invention there is provided a 
gateway for connecting an external portion of a network to an internal secured 
portion of the network wherein the gateway is arranged to identify 
automatically when a communication session exists between two mobile 
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workstatioiis both of which are connected in the external portion of the 
network. 

Embodiments of this aspect of the Invention provide for detection of 
when two mobile workstations (MNl & MN2) are commvmicating via the gateway 
(SG). This detection may, in embodiments of the invention, initiate a 
mechanism that allows the mobile workstations to communicate without using 
the gateway as an intermediary. This, in turn, allows the route by which packets 
are transferred between the first mobile workstation (MNl) and the second 
mobile workstation (MN2) to be optimised. 

According to another aspect of the invention there is provided a network 
including an internal secured portion which connects, via a gateway to an 
external portion, the network comprising a plurality of workstations including 
mobile workstations; the gateway and secin-e commmiication means by which 
information is transferable securely to a first mobile workstation In the external 
portion of the network via the gateway and by which taf ormatlon is transferable 
securely to a second mobile workstation in the external portion of the network 
via the gateway; and information transfer means located within the internal 
secured portion of the network or within the gateway and arranged to send, 
using the secure communication means, an identifier of the second mobile 
workstation to the first mobile workstation for use as an address in a packet 
originating from the first mobile workstation and destined for the second 
mobile workstation. 

Embodiments of this aspect of the invention provide an Identifier of the 
second mobile workstation (MN2) securely to the first mobile workstation 
(MNl). This identifier may allow the first mobile workstation (MNl) to 
coinmunlcate with the second mobile workstation (MN2) without using the 
gateway (SG) as an intermediary. This, in turn, allows the route by which 
packets are transferred between the first mobile workstation (MNl) and the 
second mobUe workstation (MN2) to be optimised. The identifier may be the 
external Home Address of the second mobUe workstation (MN2). 
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AccordiQg to a further aspect of the present invention there is provided a 
virtual private network including an tutemal secured portion which connects, 
via a gateway to an external portion, the network being arranged to 
communicate within the internal portion of the network using private addresses 
and comprising: a plurality of workstations including mobile workstations; the 
gateway; first secure communication means by which information is 
transferable seciu'ely to a first mobile workstation connected at the external 
portion of the network via the gateway and by which information is transferable 
securely to a second mobUe workstation connected at the external portion of 
the network via the gateway; and information transfer means arranged to send 
first security Information to the first mobile workstation and second security 
information to the second mobile workstation using the first secure 
communication means, wherein the first mobile workstation uses the first 
security information and the second mobile workstation uses the second 
security information to enable a second secme communication means by which 
further information is transferable securely between the first mobile 
workstation and the second mobile workstation without passing through the 
gateway. 

Embodiments of this aspect of the invention provide, perhaps different, 
security information to the first mobile workstation (MNl) and the second 
mobile workstation (MN2) which enables secure communications between the 
first and second mobile workstations without having to use the gateway as an 
intermediary' to secure communications. 

According to a still fxirther aspect of the present invention there is 
provided a virtual private network Including an internal secured portion which 
connects, via a gateway to an external portion, the network being arranged to 
commimicate within the internal portion of the network using private addresses 
and comprising: a plurality of workstations including mobile workstations; the 
gateway; secure communication means by which information is transferable 
securely, without passing through the gateway, between a first mobile 
workstation connected to the external portion of the network and a second 
mobile workstation connected to the external portion of the network; means for 
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dynainically updating an identifier of the first mobile workstation as it moves 
within the external portion of the network; means for communicating the 
updated identifier of the first mobile workstation to the second mobile 
workstation; and means for sending packets from the second mobile 
5 workstation to the first mobile workstation using the secure cortmiimication 
means, whereiu the packets are addressed using the updated identifier of the 
first mobile workstation and are routed without necessarily passing through the 
gateway. 

10 Embodiments of this aspect of the tuvention provide for secure 

communications between the first and second mobile workstations without 
being forced to use the gateway as an tutermediary to secure communications. 
This allows the route by which packets are transferred between the first mobile 
workstation (MNl) and the second mobile workstation (MN2) to be optimised. 

15 

For a better xmderstanding of the present invention and to understand 
how tile same may be brought into effect reference will now be made by way of 
example only to the accompanying drawlags illustrating embodiments of the 
Invention: 

20 , 

Fig. 1 is a schematic illustration of a secure virtual private network 
(SVPN) according to one embodiment of the invention; and 

Fig. 2 is a signaUing diagram of a secure virtual private network (SVPN) in 
which two mobile nodes, MNl & MN2, move into an external portion of the 
25 SVPN while communicating with each other. 

The virtual private network (VPN) 10, comprises an internal portion 12 
which is protected by a firewall or Security Gateway (SG) 20 and an external 
portion 14 which uses an unsecured communications mediiun 30, such as the 
30 internet, to communicate with the internal portion 12 via tiie Security Gateway 
20. 

The VPN 10 has a file server 16 and a pluraUty of dient workstations 
18a, 18b, 18c, 18d, 18e and 18f- The workstations 18a. 18b. and 18c are desktop 
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machmes within the internal portion 12 of the VPN 10 and are non-mobile 
nodes of the VPN 10. The workstation 18d is a portable machine, in this case a 
laptop computer, which is a mobile node (MN) of the VPN 10. The workstation 
18d is currently physically located withtn the internal portion 12. The 
workstation 18e is a portable machine (a hand-portable personal digital 
assistant), which is a mobUe node MNl of the VPN. The portable workstation 
18e is currently physically located in the external portion 14 of the VPN and 
coimected to the gateway 20 via the unsecured communications medium 30. 
The workstation 18f is a portable machine (a hand-portable ceUular radio 
telephone), which is a mobile node MN2 of the VPN. The portable workstation is " 
currently physically located in the external portion 14 of the VPN and is 
connected to the gateway 20 via a ceUrdar radio telephone network 32 and then 
the unsecured communications medium 30- 

The VPN 10 has a router 22, which provides the functionality of the HA 
of the mobile nodes of the VPN 10. The file sever 16, the Security Gateway 20, 
the router 22 or some other intelligence within the lutemal portion 12 of the 
VPN may provide the functionality of the VPN Connectivity Manager (VCM), 
which is described in more detail below. 

Embodiment 1 

This embodiment relates to a Virtual Private Network (VPN) which uses 
private (not pubUc) addresses. In the following description reference will be 
made to Fig. 2. 

The first mobile node MNl has a pair of SAs (uplink and downlink) with 
the Security Gateway (SG) and another pair of SAs (uplink and downlink) with a 
VPN Connectivity Manager (VCM). The second mobile node MN2 has a pair of 
SAs (upUnk and downlink) with the Security Gateway (SG) and another pair of 
SAs (uplink and downlink) with a VPN Connectivity Manager (VCM). The SjG has 
three pairs of SAs (uplink and downlink), one pair with MNl, one pair with MN2 
and the other pair with the VCM. The VCM has three pairs of SAs (uplink and 
downlink), one pair with MNl, one pair with MN2 and the other pair with SG. 
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A mobile node (MN), Security Association (SA), Home Agent (HA), 
Security Gateway (SG) are terms well understood by a person knowledgeable in 
Virtual Private Networks, Internet Protocol Security (IPsec) Protocol and Mobile 
Internet Protocol version 6 (MIPv6). 

The VPN Connectivity Manager (VCM) is a newly devised component of a 
VPN and the Secmity Associations between the VCM and MNl and MN2 are 
newly implemented Secimty Associations. The Security Association between a 
MN and the VCM is an Encapsulating Security Payload (ESP) SA and utilizes 
internal addresses of the VPN. 

The Security Association between the Security Gateway (SG) and liie 
mobile nodes utilizes the external, public HoA of the MNs as opposed to the 
VPN internal address. 

Let us assume that there is an existing session between MNl and MN2 
and that MN2 has previously entered the external portion of the VPN. 

When MN2 exited titie internal portion of the VPN and entered tiie 
external portion of the VPN, at least one of the uplink and downlink SAs 
between MN2 and the SG became active. 

This activation took place as a result of the following process. Inside the 
internal portion of the VPN, eitiier the inbound SPD was receiving only packets 
with addresses used inside the VPN and/or the MIPv6 binding update hst had 
only bindings with addresses used inside the VPN. When MN2 moved to the 
external portion of the VPN, the SPD started receiving packets with non~VPN 
addresses and/or the MUH^G binding update list had also bindings with non-VPN 
addresses. Because of these changes, MN2 detected the movement to the 
external portion of the VPN. At that point, it changed the SPD policy for 
Inbound VPN traffic from "no IPsec" into "use IPsec with default SG->MN2 ESP 
SA", and it changed the SPD policy for outbound VPN traffic from "no IPsec" 
into "use IPsec with default MN2->SG ESP SA". 
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In order to avoid attacks where the attacker sets up a fake network where 
the same addresses are used as inside the VPN, additional SAs may be enforced 
by the VPN owner to authenticate the messages, e.g. Router Advertisements, 
5 sent by nodes in the internal portion of the VPN, In this case, after a change of 
link, MN would always assume that it is in the external portion of the VPN 
xmless its SPD receives such a packet and the SA processing confirms the 
authentication (using e.g. an existing Authentication Header (AH) SA between 
the internal node and MN2). 

10 

The inbound SA in SG is always active, and the outbound SA is activated 
when the inbound SPD receives packets from MN2's external HoA and/or the 
MIPv6 binding cache has a binding with MN2's external HoA. 

15 If necessary, MN2 executes a Binding Update with the SG. Therefore the 

SG maps the external HoA of MN2 to the external CoA of MN2 and sends 
packets for the MN2 to the external CoA of MN2. 

The SG is an intermediate node ta communications from and to MN2 
20 using private addresses. It monitors the headers of these communications and 
stores in a cache the internal addresses of the CNs with which MN2 
communicates. The packets addressed to or sent by MN2 can be identified from 
the HoA or current CoA of MN2 in the headers. 

25 The SG sends a message 202 to the VCM with MN2's external HoA. The 

VCM receives the external HoA and stores it in its MN context database. The MN 
context comprises the MN internal HoA, the MN external HoA, the Internal 
HoAs of correspondent nodes of the MN, and details of the managed SAs with 
identification of the relevant secrets and algorithms. The VCM may send an 

30 Acknowledgement message 204 to the SG. 

When MNl exits the internal portion of the VPN and enters the external 
portion of the VPN, at least one of the upUnk and downlink SAs between MNl 
and the SG becomes active. 
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If necessary, MNl executes a Binding Update with the SG. Therefore the 
SG maps the external HoA of MN2 to the extemcd CoA of MNl and sends 
packets for the MNl to the external CoA of MNl. 

5 

The SG is an Intermediate node in communications from and to MNl 
using private addresses. It monitors the headers of these communications and 
stores in a cache the internal addresses of the CNs with which MNl 
communicates. The packets addressed to or sent by MNl can be identified 
10 from the HoA or current CoA of MNl in the header. 

The SG sends a message 202 to the VCM with MNl's external HoA, 

The VCM receives the external HoA and stores it in its MN context 
15 database. The MN context comprises the MN internal. HoA, the MN external 
HoA, the internal HoAs of correspondent nodes of the MN, and details of the 
managed SAs with identification of the relevant secrets and algorithms. The 
VCM may send an Acknowledgement message 204 to the SG. 

20 The SG also detects that MNl and MN2 are Involved in a session. The SG 

has a binding with MNl, If necessary, and therefore stores information relating 
the static identifier (HoA) and dynamic identifier (CoA) of MNl. Thus all 
packets sent by or to MNl can be identified. The SG has a binding with MN2, if 
necessary, and therefore stores information relating the static identifier (HoA) 

25 and dynamic identifier (CoA) of MN2. Thus all packets sent by or to MN2 can be 
identified. The SG detects that MNl and MN2 are in a session by detecting when 
a packet is sent from MNl to MN2 or a packet is sent firom MN2 to MNl. 

The SG sends a message 202 to the VCM indicating that MNl and MN2 
30 are having a session. This session indication message could be combined with 
or be separate from the message informing the VCM of the external HoA of 
MNl. 

VCM receives the MN1-MN2 session indication message and may send an 
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Acknowledgement message 204 to the SG. In response to this message, the VCM 
creates information for an SA pair for MN1-MN2 conmiimication. It generates 
random secrets and stores them in the MN context database in the VCM for the 
MN1-MN2 session. In a preferred implementation the secrets are keys the 
5 number and length of which depend on the implementation, and are 
accompanied by other SA material such as algorithm definition. 

The VCM sends 206 a first secret(s) defining the SA pair between MNl 
and MN2 and the external HoA of MNl to MN2 via its (internal) ESP SA with 
10 MNl. Thus there will be end-to-end security between the VCM and the internal 
address of the MNl. The VCM separately sends 210 a second secret(s) defining 
the SA pair between MNl and MN2 and the external HoA of MN2 to MNl via its 
(intemal) ESP SA with MN2. Thus there will be end-to-end security between the 
VCM and the intemal address of the MN2. 

15 

The MNl receives the secret(s) and the external HoA of MN2. It enters 
into its Security Association Database (SAD) a new ESP SA to the MN2 and a new 
ESP SA from the MN2. Each entry specifies the algorithm to be used and the 
secret(s) to be used. The MNl modifies its Security PoUcy Database (SPD) so that 

20 traffic destined for MN2 will be encrypted using one of the new SA pair and 
traffic from MN2 will be decrypted usmg the other one of the new SA pair. 
After first modifying the inboimd SPD polLcy (traffic from MN2), MNl sends an 
Acknowledgement message 212 to the VCM which forwards it to MN2. The 
outbotmd SPD policy (traffic desttaed for MN2) is only modified after the 

25 reception of Acknowledgement message 208 from MN2 via VCM. This ensures 
that MN2 can decrypt the packets when they are sent by MNl. ^ 

The MN2 receives the secret(s) and the external HoA of MNl. It enters 
into its Security Association Database (SAD) a new ESP SA to the MNl and a new 
30 ESP SA from the MNl. Each entry specifies the algorithm to be used and the 
secret(s) to be used. The MN2 modifies its Security Policy Database (SPD) so 
that traffic destined for MNl will be encrypted using one of the new SA pair and 
traffic from MNl wUl be decrypted using l3ie other one of the new SA pair- 
After first modifying the inbound SPD policy (traffic from MNl), MN2 sends an 
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Acknowledgement message 208 to the VCM which forwards It to MNl. The 
outbound SPD pohcy (traffic destined for MNl) is only modified after the 
reception of Acknowledgement message 212 from MNl via VCM. This ensuures 
that MNl can decrypt the packets when they are sent by MN2. 

The new ESP SAs provide for end-to-end encryption between the external 
HoA of MNl and the external HoA of MN2. The packets with internal addresses 
are exchanged in the crypto timnel between the external HoAs. 

The MNl uses the external HoA address to route packets to MN2. When 
MNl first sends a packet 214 encrypted by the new ESP SA to the external HoA 
of MN2, it first goes to the external HA of MN2 which forwards 216 it to the 
external CoA of MN2. After this the return routabiUty and binding process 
between the MNl and MN2 provides 218 the external CoA of MN2 to MNl. MNl 
uses the external CoA of MN2 to addbress packets 220 desttned for MN2. 

The MN2 uses the external HoA address to route packets to MNl. When 
MN2 first sends packets encrypted by the new ESP SA to the external HoA of 
MNl, they first go to the external HA of MNl which forwards them to the 
external CoA of MNl. After this the return routability and binding process 
between the MN2 and MNl provides the external CoA of MNl to MN2. MN2 uses 
the external CoA of MNl to address packets destined for MNl. 

The return routability and binding process optimises the route between 
the MNl and MN2 external CoAs and contiaues to do so as long as both MNs are 
outside the private network, without SG or VCM intervention. When either MNl 
or MN2 moves to a different point of attachment in the external portion of the 
VPN a handover procedure occurs to the new point of attachment. The 
procedure is specified by i/BPvS. If MNl moves, the CoA of MNl changes and 
this change is automatically communicated to MN2. Thus the route between 
MNl and MN2 remains optimised. 

AVhen either MN returns to the private network, the SA between that MN 
and the SG, which was used for communication between that MN and the 
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interior of the VPN, no longer receives packets. This is because the MN is now in 
the internal portion of the VPN and starts to send packets unencrypted within 
the private network. This movement from the external portion of the VPN to the 
intemal portion of the VPN is detected in the same way as the movement from 
5 the intemal portion of the VPN to the external portion of the VPN (but vice 
versa) by the SG which then informs the VCM. The VCM commands the 
remaining external MN to amend its SAD and/or SPD so that it uses its ESP SA 
with the SG again for communication with the internal MN. 

10 F.mhndlment 2 

This embodiment relates to a VPN which uses public (not private) 
addresses, such as BP addresses. In the following description reference wUl be 
made to Fig. 2. 

15 

The first mobile node MNl has a pair of SAs (uplixik and downlink) witli 
the Security Gateway (SG) and another pair of SAs (uplink and downlink) with a 
VPN Coimectivity Manager (VCM). The second mobile node MN2 has a pair of 
SAs (uplink and downlink) witii the Security Gateway (SG) and another parr of 
20 SAs (uplink and downlink) with a VPN Connectivity Manager (VCM). The SG has 
three pairs of SAs (uplink and downlink), one pair with MNl, one pair with MN2 
and the other pair with the VCM- The VCM has three parrs of SAs (uplink and 
downlmk), one pair with MNl, one pair with MN2 and the other pair with SG. 

25 The SAs between the Seciu-ity Gateway (SG) and the mobile nodes utUize 

the external, pubUc HoA of the MNs as opposed to VPN intemal addresses, 
which were used m embodiment 1 but represent only a subset of pubUc 
addresses in this embodiment. 

30 The SAs between a MN and the VCM is an Encapsulating Security Payload 

(ESP) SA and is encapsulated inside the Security Association between the SG and 
the MN. 

Let us assume that there is an existing session between MNl and MN2 
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and that MN2 has previously entered the external portion of the VPN. 

When MN2 exited the Internal portion of the VPN and entered the 
external portion of the VPN, at least one of the uphnk and downlink SAs 
between MN2 and the SG became active. This process is the same as that 
described ta relation to embodiment 1. . 

If necessary, MN2 executes a Binding Update with the SG. Therefore the 
SG maps the HoA of MN2 to the CoA of MN2 and sends packets for the MN2 to 
the CoA of MN2. 

The SG is an intermediate node in conmumications between the internal 
portion of the VPN and MN2. It monitors the headers of these communications 
and stores; in a cache the addresses of the CNs with which MN2 communicates. 
The packets addressed to or sent by MN2 can be identified from the HoA or 
current CoA of MN2 in the headers. 

The SG sends a message 202 to the VCM with MN2's HoA. The VCM 
receives the HoA and stores it in its MN context database. The MN context 
comprises the MN HoA, the HoAs of the correspondent nodes of the MN, and 
details of the managed SAs with identification of the relevant secrets and 
algorithms. The VCM may send an Acknowledgement message 204 to the SG. 

When MNl exits the internal portion of the VPN and enters the external 
portion of the VPN, at least one of the uplink and downlink SAs between MNl 
and the SG becomes active. 

If necessary, MNl executes a Blading Update with the SG. Therefore the 
SG maps the HoA of MN2 to the CoA of MNl and sends packets for the MNl to 
the CoA of MNl. 

The SG is an intermediate node in communications between the internal 
portion of the VPN and MNl. It monitors the headers of these communications 
and stores ia a cache the addresses of the CNs with which MNl communicates. 



wo 2004/036834 



PCT/IB2002/004295 



16 

The packets addressed to or sent by MNl can be identified from the Ho A or 
ctirrent CoA of MNl in the header. 

The SG sends a message 202 to the VCM with MNl's HoA. 

5 

The VCM receives the HoA and stores it in its MN context database. The 
MN context comprises the MN HoA, the HoAs of the correspondent nodes of the 
MN, and details of the managed SAs with identification of the relevant secrets 
and algorithms. The VCM may send an Acknowledgement message 204 to the 
10 SG. 

The SG also detects that MNl and MN2 are involved in a session. The SG 
has a binding with MNl, if necessary, and therefore stores information relating 
the static identifier (HoA) and dynamic identifier (CoA) of MNl. Thus all 
15 packets sent by or to MNl can be identified. The SG has a binding with MN2, if 
necessary, and therefore stores inf ormatioh relating the static identifier (HoA) 
and dynamic identifier (CoA) of MN2. Thus all packets sent by or to MN2 can be 
identified. The SG detects that MNl and MN2 are in a session by detecting when 
a packet is sent from MNl to MN2 or a packet is sent from MN2 to MNl. 

20 . 

The SG sends a message 202 to the VCM indicating that MNl and MN2 
are having a session. This session indication message could be combined with 
or be separate from the message Informing the VCM of the external HoA of 
MNl. 

25 

VCM receives the MN1-MN2 session indication message and may send an 
Acknowledgement message 204 to the SG. In response to this message, the VCM 
creates information for an SA pair for MN1-MN2 communications. It generates 
random secrets and stores them in the MN context database in the VCM for the 
30 MN1-MN2 session. In a preferred implementation the secrets are keys the 
number and length of which depend on the implementation, and are 
accompanied by other SA material siich as algorithm definition. 

The VCM sends 206 a first secret(s) defining the SA pair between MNl 
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and MN2 and the HoA of MNl to MN2 via its (encapsulated) ESP SA with MNl- 
Thus there will be end-to-end security' between the VCM and the MNl, The VCM 
separately sends 210 a second secret(s) defining the SA pair between MNl and 
MN2 and the HoA of MN2 to MNl via its (encapsulated) ESP SA with MN2. Thus 
there will be end-to-end security between the VCM and MN2. Because both the 
MNs and the VCM are using pubhc addresses, the SAs between them could also 
be direct- The encapsulation of those toner SAs mslde the outer SAs between 
the MNs and the SG is not necessary, but when used, improves overall security. 

The MNl receives the secret(s) and the external HoA of MN2. It enters 
into its Security Association Database (SAD) a new ESP SA to MN2 and a new ESP 
SA from MN2. Each entry specifies the algorithm to be used and the secret(s) to 
be used. The MNl modifies its Security Policy Database (SPD) so that traffic 
destined for MN2 wiU be encrypted using one of the new SA pair, and traffic 
from MN2 wiU be decrypted using the other one of the new SA pair. After first 
modtfying the inbound SPD policy (traffic ft:om MN2), MNl sends an 
Acknowledgement message 212 to the VCM which forwards it to MN2. The 
outbound SPD policy (traffic destined for MN2) is only modified after the 
reception of Acknowledgement message 208 from MN2 via VCM. This ensures 
that MN2 can decrypt the packets when they are sent by MNl. 

The MN2 receives the secret(s) and the HoA of MNl. It enters into its 
Security Association Database (SAD) a new ESP SA to the MNl and a new ESP SA 
from the MNl. Each entry specifies the algorithm to be used and the secret(s) 
to be used. The MN2 modifies its Security PoUcy Database (SPD) so that traffic 
destined for MNl wUl be encrypted using one of the new SA pair, and traffic 
from MNl wUl be decrypted using the other one of the new SA pair. After first 
modifyiQg the inboimd SPD poUcy (traffic from MNl), MN2 sends an 
Acknowledgement message 208 to the VCM which forwards it to MNl. The 
outbound SPD poUcy (traffic destined for MNl) is only modified after the 
reception of Acknowledgement message 212 from MNl via VCM. This ensiu'es 
that MNl can decrypt the packets when they are sent by MN2. 

The HoA received m the message from the VCM is in this embodiment 
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not necessarily used in route optimization between two nodes that already have 
a isession in the exteinal portion of the VPN (because MIPv6 may be used to 
provide the HoA directly). Instead, it is used for modification of the appropriate 
SAD entries using the new secret(s), or for securely setting up an SA between 
the HoAs by utilizing the existing SAs with SG and VCM, or for avoiding the 
unnecessary default use of direct SAs when MNs are in the internal portion of 
the VPN. 

The new ESP SAs provide for end-to-end encryption between the HoA of 
MNl and the HoA of MN2. 

The MNl uses the HoA address to route packets to MN2- Wheti MNl first 
sends packet 214 encrypted by the new ESP SA to the HoA of MN2, it first goes 
to the HA of MN2 which forwards 216 it to the CoA of MN2. After this the 
return routabihty and binding process between the MNl and MN2 provides 218 
the CoA of MN2 to MNl. MNl uses the CoA of MN2 to address packets 220 
destined for MN2. 

The MN2 uses the HoA address to route packets to MNl. When MN2 first 
sends packets encrypted by the new ESP SA to the HoA of MNl, they first go to 
the HA of MNl which forwards them to the CoA of MNl. After this the return 
routabUity and binding process between the MN2 and MNl provides the CoA of 
MNl to MN2. MN2 uses the CoA of MNl to address packets destined for MNl. 

The return routabihty and binding process optimises the route between 
the MNl and MN2 CoAs and conttnues to do so as long as the MNs have a 
session, whether they are in the interior or exterior portion of the VPN, without 
SG or VCM intervention. When either MNl or MN2 moves to a different point of 
attachment in the external portion of the VPN a handover procedure occurs to 
the new point of attachment. The procedinre is specified by MlPv6. If MNl 
moves, the CoA of MNl changes and this change is automatically 
communicated to MN2. Thus the route between MNl and MN2 remains 
optimised. 
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When either MN returns to the private network; the SA between that MN 
and the SG, which was used for communication between that MN and the 
interior of the VPN, no longer receives packets. This is because the MN is now in 
the internal portion of the VPN and starts to send packets xmencrypted within 
the private network. This movement from the external portion of the VPN to the 
internal portion of the VPN is detected in the same way as the movement from 
the internal portion of the VPN to the external portion of the VPN (but vice 
versa) by the SG which then informs the VGM, The VCM commands the 
remaining external MN to amend its SAD and/or SPD so that it uses its ESP SA 
with the SG again for communication with the internal MN. 

The external HA need not be trusted because the existing SAs with SG 
and VCM guarantee that the exchanged SA secrets defining the SA between MNl 
and MN2 cannot be spoofed. 

General 

The followLug may relate to any and all embodiments. 

The first and second secret(s) may be symmetric keys for encryption and 
decryption- The same key being used for encryption and decryption in both 
MNs or separate keys may be used for encryption/decryption rn one MN and 
used for corresponding decryption/encryption in the other MN. Alternatively, 
the secret(s) may be asymmetric keys such as pubUc and private keys. 

The preceding description has described a VCM as a separate entity to 
the SG. This provides some advantages, in that an existing VPN can be modified 
by the addition of a physical VCM. This provides backwards compatibihty. 
When the VCM is a separate entity from the SG it is necessary for it to have pre- 
existing SAs with the MNs. 

In another implementation, the fimctions of the VCM are iacorporated 
into the SG and there is no physical VCM. This has the advantage of reducing 
the number of VPN entities but necessitates modification of the SG. This 
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implementation is not necessarily backwards compatible with an existing SG, 
although it may be effected as a software update to an existing SG. When the 
VCM is part of the SG there will not be separate SAs from the VCM to the MNs. 
The VCM will use the SAs of the SG to the MNs. 

5 

The implementation of embodiments of the invention therefore require a 
modification to the internal VPN by the introduction of the functionality of the 
VCM and a modification to mobile nodes and to SGs. 

10 In the above described embodiments, the session already existed between 

MNl and MN2 before both MNl and MN2 were in the external portion of the 
VPN. Thus the trigger was the detection of an existing session between two 
'external' MNs. This triggered the process of creating an new SA, using an 
existing SA, between the two 'external' MNs. 

15 

An alternative or additional trigger is the detection of both: 

a) that a VPN node initiating a data transfer session is an 'external' node, and 

b) that the destination node of the data transfer is an 'external' node. 

This triggers the process of creating a new SA, using an existing SA, between the 
20 two 'external' nodes. 

The skilled reader wUl understand that in this document the term 
'Seciulty Association' may at times refer to a unidirectional Security 
Association, a pair of uni-dtrectional (inbound & outboimd) Security 
25 Associations and the information stored to effect these Secm-ity Associations. 

Although two-way communications have been described between MNl 
and MN2, in alternative embodiments of the invention there is only one-way, 
not two-way, traffic e.g. from MNl to MN2 or from MN2 to MNl. Thus, 
30 MN1/MN2 may be a source and destination of data, a soxu-ce only or a 
destination only. 

Whilst endeavouring in the foregoing specification to draw attention to 
those features of the invention believed to be of particular importance it should 
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be understood that the AppUcant claims protection m respect of any patentable 
feature or combination of features hereinbefore described, referred to and/or 
shown in the drawings, whether or not particular emphasis has been placed 
thereon. 
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Claims 

1. A gateway for connecting an external portion of a network to an internal 
secured portion of the network wherein the gateway is arranged to identify 
automatically when a communication session exists between two mobile 
workstations both of which are connected in the external portion of the 
network. 

2. A gateway as claimed in claim 1, having means for monitoring the source 
and destination of received packets. 

3- A gateway as claimed in claim 1 havtug secure communication means by 
which information is transferable seou-ely to the two mobile workstations 
separately. 

4. A gateway as claimed in claim 3 wherein the secure commimication 
means includes a first Security Association with a first mobile workstation and 
a second Secmlty Association with a second mobile workstation. 

5. A gateway as clauned in claim 3 or 4, wherein the gateway is arranged to 
send, using the secure communication means, an identifier of a second mobUe 
workstation to a first mobile workstation for use as an address in a packet 
originating from the first mobile workstation and destined for the second 
mobile workstation 

6. A gateway as claimed in claim 5 wheretu the identifier of the second 
mobile workstation is a Home Address. 

7. A gateway as claimed in any one of claims 3 to 6, wherein the gateway is 
arranged to send, using the secure communication means, an identifier of the 
first mobile workstation to the second mobile workstation for use as an address 
in a packet originating from the second mobUe workstation and destined for the 
first mobile workstation. 
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8. A gateway as claimed in claim 7 wherein the identifier of the first mobile 
workstation is a Home Address, 

9. A gateway as claimed in any one of claims 3 to 8, wherein the gateway is 
arranged to send first security information to the first mobile workstation and 
second security information to the second mobUe workstation using the secure 
communication means, wherein the first mobile workstation uses the first 
securit^^ information and the second mobile workstation uses the second 
security information to enable a second secure conununication means by which 
further information is transferable securely between the first mobile 
workstation and the second mobile workstation without passing through the 
gateway. 

10- A gateway as claimed in claim 9, wherein the second secure 
communication means comprises Security Associations. 

11. A gateway as claimed in any one of claims 1 to 10 wherein the gateway is 
further arranged to identify automatically when a mobile workstation moves 
between the mtemal and the external portions of the network. 

12. A network including an internal secured portion which connects, via a 
gateway to an external portion, the network comprising a plurality of 
workstations including mobile workstations; the gateway and secure 
communication means by which information is transferable securely to a first 
mobile workstation in the external portion of the network via the gateway and 
by which information is transferable securely to a second mobile workstation in 
the external portion of the network via the gateway; and information transfer 
means located within the mtemal secured portion of the network or within the 
gateway and arranged to send, using the secure communication means, an 
identifier of the second mobUe workstation to the first mobile workstation for 
use as an address in a packet originating from the first mobile workstation and 
destined for the second mobile workstation. 

13. A network as claimed m claim 12, wherein the information transfer 
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means is further arranged to send, using the secure communication paeans, an 
identifier of the first mobile workstation to the second mobile workstation for 
use as an address in a packet originating from the second mobile workstation 
and destined for the first mobile workstation. 

14. A network as claimed In claim 12 or 13 wherein the identifier of a mobile 
workstation is a Home Address of the mobile workstation. 

15. A network as claimed in any one of claims 12 to 14 wherein the secure 
communication means provides an encrypted communications channel to the 
first mobile workstation and an encrypted conmiunications channel to the 
second mobile workstation. 

16. A network as claimed in any one of claims 12 to 15 wherein the secure 
communication means comprises a first Security Association and a second 
Secmity Association. 

17. A network as claimed in any one of claims 12 to 16 wherein the gateway 
is arranged to detect a commiuilcations session between two mobile 
workstations which are connected at the external portion of the network. 

18. A network as claimed in any one of claims 12 to 17 further comprising: 
means for dynamically updating an identifier of the first mobile 

workstation as it moves withm the external portion of the network; 

means for communicating the updated identifier of the first mobile 
workstation to the second mobile workstation; and 

means for sending packets from the second mobile workstation to the 
first mobile workstation using the second secin-e commimication means, 
wherein the packets are addressed using the updated identifier of the first 
mobile workstation. 

19. A network as claimed m claun 18 wherein the updated Identifier is a 
Care-of-Address. 
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20, A network as claimed in any one of claims 12 to 19 wherein the network 
is arranged to use private addresses to communicate within the internal portion 
of the network and the identifier of the second workstation is a pubhc address. 

21. A method of securely routing communications between a first mobile 
node and a second mobile node of a network including an Intemal secured 
portion which connects, via a gateway to an external portion, comprising the 
steps of: 

maintaining a secure communication means by which information is 
transferable securely to a first mobile node in the external portion of the 
network via the gateway and by which information is transferable securely to a 
second mobile node in the external portion of the network via the gateway; 

sending an identifier of the second mobile node to the first mobile node 
using the secure communication means; and 

addressing a packet sent from the first mobile node to the second mobile 
node using the Identifier of the second mobile node and routing the packet, 
using the identifier of tiie second mobile node, from the first mobile node to 
the second mobile node, not necessarily via the gateway. 

22. A method as claimed in claim 21 further comprising the steps of: 

sending an identifier of the first mobile node to the second mobile node 

using the secure communication means; and 

addressing a packet sent from the second mobile node to the first mobile 

node using the identifier of the first mobile node and routing the packet from 

the second mobile node to the first mobile node, not necessarily via the 

gateway. 

23- A mobile workstation for connecting to an external portion of a network 
that Includes an intemal secured portion connected, via a gateway to the 
external portion, comprising: 

means for ustag a secure coromunication means by which information is 
transferable securely from the tatemal portion of the network to the mobile 
workstation via the gateway; 

means arranged to receive, via the first secure commimication means, an 
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identifier of another mobile workstation also connected to the external portion 
of the network; and 

means for including the identifier of the other mobile workstation as an 
address in a packet for transmission to the other mobile workstation. 

24. A virtual private network including an uitemal secured portion which 
connects, via a gateway to an external portion, the network being arranged to 
communicate within the internal portion of the network using private addresses 
and comprising: 

a pluraUty of workstations Including mobile workstations; 

the gateway; 

first secure communication means by which information is transferable 
securely to a first mobile workstation connected at the external portion of the 
network via the gateway and by which information is transferable securely to a 
second mobile workstation connected at the external portion of the network via 
the gateway; and 

information transfer means arranged to send first security information 
to the first mobUe workstation and second security information to the second 
mobile workstation using the first secure communication means, wherein the 
first mobile workstation uses the first security Information and the second 
mobile workstation uses the second security information to enable a second 
secure communication means by which further information is transferable 
securely between the first mobile workstation and the second mobile 
workstation without passing through the gateway. 

25. A virtual private network as claimed in claim 24, wherein the further 
information is transferable in packets using pubUc addresses. 

26. A network as claimed in claim 24 or 25, wherein the first secure 
communication means provides an encrypted communications channel to the 
first mobile workstation and an encrypted communications channel to the 
second mobile workstation. 

27. A network as claimed in claim 24, 25 or 26 wherein the first secure 
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commxmication means comprises a first Security Association and a second 
Security Association. 

28. A network as claimed in any one of claim 27, wherein the first Secxirity 
Association is from the gateway to the first mobile workstation and the second 
Security Association is from the gateway to the second mobile workstation. 

29. A network as claimed in claim 28 wherein the first Security Association 
is from the internal portion of the network to the first mobile workstation and 
the second Security Association is from the internal portion of the network to 
the second mobile workstation. 

30. A network as claimed la claim 27, 28 or 29, wherem commxmications 
using the first and second Security Associations use addresses which are 
private. 

31. A network as claimed m any one of claims 24 to 30, wherein the second 
secure coramunicatlon means provides encrypted communications channels 
between the first and second mobile workstations. 

32. A network as claimed in claim 31 wherein the first and second security 
Information define the encryption/decryption of the encrypted communications 
channels. 

33- A network as claimed in any one of claims 24 to 32 wherein the second 
secure c ommuni cation means comprises at least a third Secimty Association 
from the first mobile workstation to the second mobile workstation. 

34. A network as claimed la claim 33 wherein first and second security 
Information defines at least the third Security Association. 

35. A network as claimed in any one of claims 24 to 34, wherein at least a 
portion of the first security hiformation and at least a portion of the second 
secmlty information are created within the tntemal portion of the network. 
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36. A network as claimed in any one of claims 24 to 35, wherein the gateway 
is arranged to detect a communications session between two mobile 
workstations which are coimected at the external portion of the network. 

37. A network as claimed in any one of claims 24 to 36, wherein the second 
secure communication means is enabled by the adaptation of databases in the 
first and second mobile workstations. 

38. A network as claimed in any one of claims 24 to 3 7, further comprising: 
information transfer means arranged to send, using the first seciu-e 
communication means, an identifier of the second mobile workstation to the 
first mobile workstation for use as an address in a packet originating from the 
first mobile workstation and destined for the second mobile workstation. 

39. A network as claimed in claim 38 wherein the identtCLer of the second 
mobile workstation is a Home Address. 

40. A network as claimed in claim 38 or 39, wherein the identifier of the 
second mobile workstation^is a public address. 

41. A network as claimed in any one of claims 24 to 40 further comprising: 
means for dynamically updating an identifier of the first mobile 

workstation as it moves within the external portion of the network; 

means for communicating the updated identifier of the first mobile 
workstation to the second mobile workstation; and 

means for sending packets from the second mobile workstation to the 
first mobile workstation using the second secure commmiication means, 
wherein the packets are addressed using the updated identifier of the first 
mobile workstation. 

42. A network as claimed in claim 41 wherein the updated identifier is a 
Care-of-Address. 
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43. A method of seciirmg communications between a first mobile node and a 
second mobile node of a virtual private network including an internal secured 
portion which connects, via a gateway to an external portion, comprising the 
steps of: 

communicating within the internal portion of the network usiag private 
addresses; 

malQtaitiing a first secure communication means by which information 
is transferable securely to the first mobile node iu the external portion of the 
network via the gateway and by which information is transferable securely to a 
second mobile node in the external portion of the network via the gateway; 

sending first security information to the first mobile node using the first 
secure communication means; 

sending second security information to the second mobile node using the 
first secure communication means; 

creating a second secure commimication means la the first mobile node, 
using the first security information in the first mobile node and the second 
security information tn the second mobile node; and 

using the second secure communication means, and not the first secure 
communication means, for transferring further information between the first 
and second mobUe nodes while they both remain in the external portion of the 
network. 

44. A mobile workstation for connecting to a virtual private network that 
includes an internal secxn-ed portion connected, via a gateway to the external 
portion, and for communicating while in the internal portion using packet 
addresses which are private to the network, the mobile workstation comprising: 
means for using a first secure communication means by which packets 
addressed to the private address of the mobile workstation are transferable 
securely from the internal portion of the network to the mobile workstation via 
the gateway; 

means arranged to receive, via the first secure communication means, 
first security information for enabling a second secure commimication means; 
and 

means for using the enabled second secure commimication means to 
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securely receive fiirtlier packets, addressed to a public address of the mobile 
workstatioEL, from another mobile workstation also m the external portion of 
the network. 

5 45. A mobile workstation as claimed in claim 44 further comprising a 
database and means for modifying the database in response to the received first 
security information. 

46. A mobile workstation as claimed in claim 45 wherein the database 
10 includes a Security Association Database (SAD) which is modified to include a 

new Secmity Association. 

47. A mobile workstation as claimed in claim 46 wherein the database 
includes a Security Policy database which is modified so that packets for the 

15 other mobile workstation use the new Security Association. 

48. A virtual private network including an internal secured portion which 
connects, via a gateway to an external portion, the network being arranged to 
communicate within the internal portion of the network using private addresses 

20 and comprising: 

a plurality of workstations including mobile workstations; 
the gateway; 

secure communication means by which information is transferable 
securely, without passing through the gateway, between a first mobile 
25 workstation connected to the external portion of the network and a second 
mobile workstation connected to the external portion of the network; 

means for dynamically updating an identifier of the first mobile 
workstation as it moves within the external portion of the network; 

means for communicating the updated identifier of the first mobile 
30 workstation to the second mobile workstation; and 

means for sending packets from the second mobile workstation to the 
first mobile workstation using the secin-e communication means, wherein the 
packets are addressed using the updated identifier of the first mobile 
workstation and are routed without necessarily passing through the gateway. 
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49. A network as claimed in claim 48 wherein the updated identifier is a 
Care-of-Address. 

5 50. A network as claimed in claim 48 or 49 wherein the secure 
communication means provides encrypted communications channels between 
the first and second mobile workstations. 

51. A network as claimed in any one of claims 48 to 50 wherein the secure 
) commimication means comprises a Security Association from the first mobUe 

workstation to the second mobile workstation and a Security Association from 
the second mobile workstation to the first mobile workstation- 

52. A network as claimed in any one of claims 48 to 51 wherein the secure 
communication means is enabled by databases in the first and second mobile 
workstations. 

53. A method of optimising the routing of secure communications between a 
first mobile node and a second mobile node of a network including an internal 
secured portion which connects, via a gateway to an external portion,, 
comprising the steps of: 

communicating within the internal portion of tiie network using private 
addresses; 

creating a secure commimication means by which information is 
transferable securely, without passing through the gateway, between a first 
mobile node of the external portion of the network and a second mobile node of 
the external portion of the network; 

moving the first mobile node within the external portion of the network; 

modifying an identifier of the first mobile node in response to its 
movement; 

communicating the modified identifier of the first mobile node to the 
second mobile node; and 

sending a packet from the second mobile node for reception by the first 
mobile node, without necessarily passing via the gateway, after addressing it 
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using the updated identifier of the first mobile and securing it using the secure 
communication means. 

54. A mobile workstation for connecting to an external portion of a network 
that includes an internal secured portion connected, via a gateway to the 
external portion, comprising: 

means for communicating using private addresses when in the internal 
portion of the network; 

means for enabling and using a secure commimication means by which 
information Is transferable securely from the mobile workstation, when in the 
external portion of the network, to another mobile workstation connected to the 
external portion of the network without passing through the gateway; 

means for receiving an identifier of the other mobile workstation; and 

means for sending packets, when in the external portion of the network, 
to the other mobile workstation using the secure communication means and 
the received identifier. 

55. A mobile workstation as claimed in claim 54 wherein the identifier is a 
pubtic address. 

56. A mobUe workstation as claimed in claim 55 wherein the identifier is a 
Home Addi-ess or a Care-of-Address. 
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